Red Hat Linux Security Advisories & CVEs
3200 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-17679] Insufficient validation of untrusted input in Print Preview
Insufficient validation of untrusted input in Print Preview. Red Hat rates this important (CVSS 6.8). Weakness: CWE-346.
Medium [CVE-2026-17664] Insufficient validation of untrusted input in Loader
Insufficient validation of untrusted input in Loader. Red Hat rates this important (CVSS 6.8). Weakness: CWE-346.
Medium [CVE-2026-17662] Insufficient policy enforcement in Prefetch
Insufficient policy enforcement in Prefetch. Red Hat rates this important (CVSS 6.5). Weakness: CWE-346.
Medium [CVE-2026-62946] Denial of Service via integer overflow in JNX decoder on 32-bit systems
Denial of Service via integer overflow in JNX decoder on 32-bit systems. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-190.
Medium [CVE-2026-62363] Denial of Service via crafted argument in fx operation
Denial of Service via crafted argument in fx operation. Red Hat rates this moderate (CVSS 5). Weakness: CWE-787.
Medium [CVE-2026-18382] service-account client credentials sent to user-controlled token_url
service-account client credentials sent to user-controlled token_url. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-918.
Medium [CVE-2022-4994] wean fast IN from emulator_pio_in
wean fast IN from emulator_pio_in. Red Hat rates this low (CVSS 5.5). Weakness: CWE-908.
Medium [CVE-2026-62343] Denial of Service via heap buffer over-write in morphology operation with invalid kernel
Denial of Service via heap buffer over-write in morphology operation with invalid kernel. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-805.
Medium [CVE-2026-64685] Information Disclosure via Crafted Image File
Information Disclosure via Crafted Image File. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-125.
Medium [CVE-2026-15157] HTTP header injection via unvalidated blob-like body type property
HTTP header injection via unvalidated blob-like body type property. Red Hat rates this moderate (CVSS 4.2). Weakness: CWE-93. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-14643] Cross-user information disclosure due to improper Cache-Control directive parsing
Cross-user information disclosure due to improper Cache-Control directive parsing. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-524. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-16728] Response desynchronization via retry interceptor with mismatched Content-Length
Response desynchronization via retry interceptor with mismatched Content-Length. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-54249] Information disclosure through unvalidated file references.
Information disclosure through unvalidated file references. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-918.
Medium [CVE-2026-46678] Server-Side Request Forgery (SSRF) bypass exposes cloud credentials.
Server-Side Request Forgery (SSRF) bypass exposes cloud credentials. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-918.
Medium [CVE-2026-65975] Remote clients can execute server tools with forged arguments due to improper message sanitization.
Remote clients can execute server tools with forged arguments due to improper message sanitization. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-88. Affected product named by the advisory: Lightspeed Core.
Medium [CVE-2026-13346] Arbitrary file installation via malicious package indexes
Arbitrary file installation via malicious package indexes. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:48788 with package python-pip-main-26.2-0.1.hum1.
Medium [CVE-2026-62995] JWT Malleability via Non-Standard Padding
JWT Malleability via Non-Standard Padding. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-1286. Red Hat lists fixing advisory RHSA-2026:48758 with package jaeger-main-2.20.0-0.8.hum1.
Medium [CVE-2026-16729] Cookie attribute injection allows bypassing security protections
Cookie attribute injection allows bypassing security protections. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-140. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-52791] Privilege Escalation Vulnerability via SUID/SGID Bit Preservation
Privilege Escalation Vulnerability via SUID/SGID Bit Preservation. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-281.
Medium [CVE-2026-67216] Denial of Service due to inefficient JSON object comparison
Denial of Service due to inefficient JSON object comparison. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770.